nix: finish the current-behaviour comment sweep in touched files

Rewrite the remaining narration in files the previous commit touched:
"moved"/"sat"/"was REMOVED"/"old default" comments in swarm-bao,
swarm-otel, glue-bao-tls, nats-authelia, swarm-controller, swarm-ui,
swarm-otel-service, swarm-authelia-service, the deploy.nix rename table,
hive-ci, hive-forge/service, hive-tls, hyperhive, swarm-nats, swarm.nix
and a few module-eval fixtures, so each says where a thing is or why it
is so now.

Revert the comment edits inside shell script strings in hive-tls,
swarm-nats and the forge token mint to their previous text, so those
generated units are unchanged. The only unit still changing is
swarm-bao-pki (two comment lines in its script). Refs #3902

nix/host-modules/deploy.nix

@@ -25,7 +25,7 @@
 # exactly that shape, and a bare bool leaves it unrepresentable.
 #
 # ⚠️ The renames below are deliberately in this one file rather than
-# spread across the service modules, so the whole move has a single home
+# spread across the service modules, so all of them have a single home
 # and a single file to delete when the deprecation window closes — the
 # shape ./swarm-peers-removed.nix already uses.
 { lib, config, ... }:
@@ -99,8 +99,8 @@ in
       [ "services" "hyperhive" "swarm" "authelia" "usersFile" ]
       [ "services" "hyperhive" "deploy" "authelia" "usersFile" ]
     )
-    # `hostClientSecretDir` and `hostUsersFile` moved in the same commit and
-    # deliberately have NO entry here. A rename module contributes a
+    # `hostClientSecretDir` and `hostUsersFile` deliberately have NO entry
+    # here. A rename module contributes a
     # *definition* to its target, and both are `readOnly`, which refuses a
     # second one — so a shim for either makes every evaluation fail with
     # "set multiple times", naming the option's own default as the rival
@@ -139,7 +139,7 @@ in
       [ "services" "hyperhive" "deploy" "swarm-otel" "enable" ]
     )
     # ⚠️ Not to be confused with `services.hyperhive.otel.clientSecretFile`,
-    # a different option on the hive tier that is not part of this move. A
+    # a different option on the hive tier that is not part of this table. A
     # bare `clientSecretFile` matches five distinct options across the tree.
     (lib.mkRenamedOptionModule
       [ "services" "hyperhive" "swarm" "otel" "clientSecretFile" ]
@@ -177,14 +177,14 @@ in
     # The queue's callout identity. What stays under `swarm.nats` is what the
     # queue IS to every hive — the ports it answers on and the client id it is
     # registered under; these five are what the host running it decides. The
-    # responder package is one of them now, further down with the other
-    # `*.package` moves.
+    # responder package is one of them, renamed further down with the other
+    # `*.package` entries.
     #
-    # ⚠️ The two PUBLIC keys move with their seeds. A public key looks
+    # ⚠️ The two PUBLIC keys follow their seeds. A public key looks
     # swarm-wide, and the user key genuinely is published to every client that
     # connects — but peers RECEIVE it over the wire, they never configure it,
     # and splitting a keypair across two namespaces is worse than either
-    # placement. `enable` moved earlier; its shim is the one above.
+    # placement. `enable`'s shim is the one above.
     (lib.mkRenamedOptionModule
       [ "services" "hyperhive" "swarm" "nats" "autoGenerateCallout" ]
       [ "services" "hyperhive" "deploy" "nats" "autoGenerateCallout" ]
@@ -209,8 +209,8 @@ in
     # The rest of the forge split. What stays under `swarm.forge` is what the
     # forge IS from any hive's point of view — the names and ports it answers
     # on, the URLs it advertises, the client id it is registered under; these
-    # four are what the host running it decides. Its package moved as well,
-    # further down with the other `*.package` moves. `sso` splits
+    # four are what the host running it decides. Its package is renamed
+    # further down with the other `*.package` entries. `sso` splits
     # because its two halves are different facts: the client id must match the
     # entry in authelia's register, the secret is a path on this machine.
     #
@@ -238,8 +238,8 @@ in
     # The homeserver, split the same way. `swarm.matrix` keeps what it IS to
     # every hive — the name it answers to, the ports and URLs it is reached
     # on, the client id it is registered under. These six are what the host
-    # running it decides; its two packages moved as well, further down with
-    # the other `*.package` moves. ⚠️ `enable` is NOT here: its shim lives in
+    # running it decides; its two packages are renamed further down with
+    # the other `*.package` entries. ⚠️ `enable` is NOT here: its shim lives in
     # ./hive-matrix.nix, so that file is the one
     # to check before assuming this table is the whole matrix story.
     (lib.mkRenamedOptionModule
@@ -360,11 +360,11 @@ in
       ''
     )
 
-    # The WireGuard mesh, whole. Unlike every rename above this one moves a
+    # The WireGuard mesh, whole. Unlike every rename above this one covers a
     # namespace rather than a toggle: nothing under it is a fact another hive
     # reads. A peer needs this host's `wireguardEndpoint` — the roster entry
     # in ./swarm.nix, which stays — and nothing about the interface this host
-    # brings up. `listenPort` moves for the same reason and is easy to read
+    # brings up. `listenPort` follows for the same reason and is easy to read
     # the other way: it is what this host *binds*, while the port a peer
     # *dials* is the one inside `wireguardEndpoint`.
     (lib.mkRenamedOptionModule
@@ -389,10 +389,9 @@ in
     )
 
     # Which build a service runs is a decision of the host that runs it, so
-    # every `*.package` follows its `enable` across. The split these replace
-    # was the sharpest case: `gui.enable` had already moved while
-    # `gui.package` stayed, so one client's two halves sat in two namespaces
-    # and ./hive-matrix.nix said so in a comment above the option.
+    # every `*.package` follows its `enable` across. Left in separate
+    # namespaces they split one client's two halves, as `gui.enable` and
+    # `gui.package` would.
     (lib.mkRenamedOptionModule
       [ "services" "hyperhive" "swarm" "matrix" "package" ]
       [ "services" "hyperhive" "deploy" "matrix" "package" ]
@@ -413,9 +412,9 @@ in
       [ "services" "hyperhive" "swarm" "victoriametrics" "package" ]
       [ "services" "hyperhive" "deploy" "victoriametrics" "package" ]
     )
-    # With this one `services.hyperhive.swarm.ui` holds nothing at all — it had
-    # exactly two options and both have moved, so the namespace now exists only
-    # as this entry and the `enable` one above it.
+    # With this one `services.hyperhive.swarm.ui` holds nothing at all — its
+    # two options are both renamed, so the namespace exists only as this
+    # entry and the `enable` one above it.
     (lib.mkRenamedOptionModule
       [ "services" "hyperhive" "swarm" "ui" "package" ]
       [ "services" "hyperhive" "deploy" "swarm-ui" "package" ]